Re:GitHub doesn't show search field unless you sign in
by EGreg on Sunday March 20, 2016 @12:05PM
(#11323394)
Not that difficult!
Simply sign your session ids with an HMAC, to verify the id without any I/O! And require something expensive to create a session (such as a hash-based challenge request). Sessions are usually not needed for static sites, so by the time the person searches, their browser will have earned one session. A spammer on the other hand wouldn't have the computational power to create the various sessions. Also, if a spammer's IP is detected, the computational complexity can be increased for that IP.
Re:GitHub doesn't show search field unless you sign in
by newjersey on Sunday March 20, 2016 @10:09AM
(#11322950)
Well, at some point you have to block legitimate traffic. My thought was it doesn't have to be black and white. Maybe require the user to solve a captcha after the nth search from the same IP address? How big are the biggest of botnets? A few hundred thousand computers? Or maybe even require captcha for every unauthenticated search.
Re:GitHub doesn't show search field unless you sign in
by EGreg on Sunday March 20, 2016 @12:06PM
(#11323399)
You mean just for the first one, to get a session id.
DDOS scripts create new sessions on every attack request. It's a very hard problem to solve without blocking legitimate traffic too.